webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-11-03 11:53:04 +03:00
Code Activity
105,630 Commits 12 Branches 481 Tags
ddeab2a11ffd9ffdbb0db84e9c763ce202a4a4aa
Commit Graph

21 Commits

Author SHA1 Message Date
Michal Čihař
3ee65fc8bf Use MAC to verify IV as well 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 10:29:46 +02:00
Michal Čihař
ef03daf658 Remove hashing of blowfish secret 
New code doesn't have problems with longer secrets.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:59:02 +02:00
Michal Čihař
d29df46b3a Do not generate too long session secret 
We need 16+16 bytes, generating 256 is not really needed.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:58:39 +02:00
Michal Čihař
e2a25d773d Merge pmaServer and pmaPass cookies 
This addresses several issues:

- makes server name encrypted and authenticated, so that it can not be
  tampered
- reduces cookie usage
- reduces overhead of encryption/authentication

The pmaUser cookie is still separate to avoid different lifetime
(pmaUser has month lifetime, while pmaAuth is session only by default).

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
2a2d865d50 Validate input data from cookies 
We expect strings only, so not accept anything else.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-22 09:47:32 +02:00
Michal Čihař
3ba8a026fc Use hash_hmac for MAC rather than plain SHA1 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:56:52 +02:00
Michal Čihař
1543be7138 Use https to access phpmyadmin.net 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-18 16:22:33 +02:00
Michal Čihař
fc6ef261eb Remove Swekey support 
It is buggy and their servers are no longer working.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-11 09:02:58 +02:00
Michal Čihař
a97be3a604 Improve cookie encryption 
- use MAC to validate content before decryption
- create unique IV for every cookie

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-07-08 17:40:05 +02:00
Michal Čihař
8a142aba73 Adjust tests to new behavior 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-06-15 11:45:16 +02:00
Michal Čihař
11eb574242 Improve handling of logout 
- add separate script for handling logout
- no longer require old_usr for all authentication methods
  (this avoids potential information leak)
- require valid token for logout

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 13:02:21 +02:00
Michal Čihař
381c80dda4 Split test cases to avoid huge test methods 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:35:13 +02:00
Michal Čihař
21db724c85 Remove need for having define for test 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-05-23 12:09:36 +02:00
Michal Čihař
2148e7cad8 Implement test for Cookie auth without runkit 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 20:21:40 +01:00
Michal Čihař
ae1ccf3e6a Remove PmaAbsoluteUri configuration directive 
Fixes #11412

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-02-03 17:41:29 +01:00
Michal Čihař
b450e58dbb Remove require of libraries included in test bootstrap 
There is no need to specify them in every test when we already do it
globally.

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 16:43:16 +01:00
Michal Čihař
908c44c027 Remove no longer used variables 
Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 14:51:08 +01:00
Michal Čihař
19f9e830eb Remove no longer needed code for language selection 
Issue #11847

Signed-off-by: Michal Čihař <michal@cihar.com>
 2016-01-12 14:51:08 +01:00
Madhura Jayaratne
9e38e02593 Update auth plugin tests 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-12-18 17:36:05 +11:00
Hugues Peccatte
0e5de28eaa Remove side effects in declaration files. 
Signed-off-by: Hugues Peccatte <hugues.peccatte@gmail.com>
 2015-11-15 17:31:53 +01:00
Madhura Jayaratne
ab49273856 Rename test classes 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
 2015-10-15 20:57:27 +11:00